Cloudy with a Chance of Abused Privacy Rights: Modifying Third Party Fourth Amendment Standing Doctrine Post-Spokeo

Article excerpt

Introduction

"[J]ust as the Internet has opened up the world for each and every one of us, it has also opened up each and every one of us to the world. And increasingly, the price we're being asked to pay for all of this connectedness is our privacy."

-Gary Kovacs1

The American people have significantly valued their privacy since colonial times, and there has been a continual battle to safeguard this privacy.2 During the American Revolutionary War, people were concerned about general warrants that often resulted in law enforcement ransacking people's homes and belongings;3 today, privacy concerns are still grounded in a fear of excessive government intrusion into spaces that the people have generally regarded as private and secure.4 Because Americans value individual privacy so highly, Congress has passed many laws protecting our privacy and personal information.5

However, laws seeking to protect privacy have often proven inadequate, in keeping pace with significant technological progress.6 This was true of the 1968 Wiretap Act,7 which was ultimately amended by the Electronic Communications Privacy Act of 1986 (ECPA).8 Now, as technology continues to develop and progress,9 the validity of the ECPA is being called into question.

One such development, the increasing availability of cloud storage solutions, has revolutionized Internet usage.10 Prior to 1986, when the ECPA was first enacted, very few people outside of the business community had access to the Internet.11 Individuals and businesses used to maintain physical control over their records by storing documents in filing cabinets or on local hard drives or servers. As personal use of the Internet increased, questions about the adequacy of privacy standards arose, leading to the privacy protections and law enforcement access standards provided for in the ECPA.12 Today, nearly everyone uses the Internet on a daily basis-whether for communicating by email, storing documents in the cloud, or connecting with friends and colleagues through social media.13 Both individuals and businesses have become more reliant upon third-party cloud storage solutions, such as the services provided by the Microsoft Corporation ("Microsoft"), because of their efficiency and ease of use.14

Because of this increase in Internet usage and shift in storage solutions, Microsoft has suggested that the data privacy standards set forth in the ECPA are no longer sufficient to protect cloud users' communications and personal information.15 The company is challenging sections 2703 and 2705(b) of the Stored Communications Act (SCA),16 which governs the privacy of electronic communications17 that have been in storage for various periods of time.18 Microsoft alleges that the government's use of "no-notice warrants" under section 270319 in conjunction with "secrecy orders" under section 270520 violate the company's First Amendment rights and its cloud customers' Fourth Amendment rights.21 In its Fourth Amendment claim, Microsoft asserts that secrecy orders illegally eliminate notice to the targets of the searches and seizures22 and unfairly prevent the company from being transparent with its customers.23

Microsoft's Fourth Amendment claim raises a unique standing issue-namely, whether Microsoft can bring the claim on behalf of its customers. Generally speaking, a business may bring such a lawsuit,24 but doing so based on a Fourth Amendment claim is distinctive because the standing inquiry requires a more substantive analysis of the issues.25 Specifically, for a business to bring a constitutional challenge on behalf of its customers, at least one customer must have standing to bring the claim himself; thus, if Microsoft's customers do not have standing to sue, neither does Microsoft.26 However, establishing individual standing for the improper sharing of personal information or data has become more difficult after the united states Supreme Court's recent decision in Spokeo, Inc. …